The growth of computer networking has brought with it an explosion in the number of malicious software attacks, commonly referred to as “malware attacks.” “Malware,” short for malicious software, is software that is designed for hostile or intrusive purposes. For example, malware may be designed with the intent of gathering information, denying or disrupting operations, accessing resources without authorization, or other abusive purposes. Types of malware attacks may include virus attacks, worm attacks, trojan horse attacks, spyware attacks, adware attacks, botnet attacks, rootkit attacks, and denial of service attacks (DDOS). Malware developers typically distribute their software via the Internet, often clandestinely. As Internet use continues to grow around the world, malware developers have more incentives than ever for releasing this software.
Malware is often installed on computers running browsers while communicating with malicious web pages that exploit browser vulnerabilities. These malicious web pages may use an “exploit” or “exploit kit” to download and run an executable program of an attacker's choosing on a visitor's computer without any interaction from the user. That is, flaws in either the browser or automatically-launched external programs and extensions can allow a malicious web page to install malware automatically when a user visits the malicious web page, such that the user may not be aware of the installation. Examples of exploit kits include Blackhole and Incognito exploit kits. These kits utilize an obfuscation routine to hide the exploit code from anti-virus engines and web crawlers seeking exploit kit installations.
Often the web page accessed by a user is an “innocent” web page that has been compromised to reference a malicious web page. Attackers compromise the “innocent” web page in order to drive traffic to their malicious web page, which is used for hosting malicious code, such as malicious executables or browser exploit code. Attackers find ways to inject Hypertext Markup Language (“HTML”) code into an innocent web page, which causes the visitor's browser to request and process content from the malicious web page without the visitor's knowledge.
Malware propagation wastes valuable resources, such as system user time, system administrator resources, network bandwidth, disk space, and central processing unit (“CPU”) cycles. Malware can also corrupt data files such that the originals may not be recoverable. Additionally, malware can cause the compromised computer to transmit confidential data (e.g., banking information, passwords, etc.) to the malware attacker.